// https://syzkaller.appspot.com/bug?id=9c557bdc7328e1ab4f0325699da821c22e47ab93 // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include long r[10]; void loop() { memset(r, -1, sizeof(r)); r[0] = syscall(__NR_mmap, 0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(__NR_pipe, 0x20dfbff8ul); if (r[1] != -1) r[2] = *(uint32_t*)0x20dfbff8; if (r[1] != -1) r[3] = *(uint32_t*)0x20dfbffc; r[4] = syscall(__NR_socket, 0x2ul, 0x1ul, 0x0ul); *(uint64_t*)0x201a2000 = (uint64_t)0x20dc6000; *(uint64_t*)0x201a2008 = (uint64_t)0xc3; memcpy((void*)0x20dc6000, "\x19\x7e\xf0\x49\xe6\x89\x5d\xd0\x05\x2f\x3e\x98\x04\x5a\x85" "\x09\x15\x3c\x1e\x6f\x68\x1c\xf9\x9c\x19\xca\x07\x2f\x28\x09" "\xd8\x33\x79\x82\xd7\x7b\xdb\xda\x3c\x32\x43\x31\x2a\x8b\x2a" "\x75\x8c\x4d\xb7\x5c\xa8\x40\x48\x9d\xac\x77\xf1\x66\xf8\xdd" "\xa8\x65\xd9\x7f\xdc\xe1\x1e\xd8\x9e\xd5\x86\x51\x9d\x8d\xaf" "\x92\x11\x91\xdd\xf2\x3a\x4a\x0a\x3f\x91\xa5\xed\x28\xaa\x84" "\xe7\x3a\x81\xb6\xda\x06\xe6\xa7\x67\x6a\x3b\x75\xa9\xd2\x6f" "\xf6\x9d\xc1\x66\xc8\xbc\x9e\x1c\xef\x52\x22\x6b\xf3\xc0\x1f" "\xff\xa8\x41\x33\x2e\x78\xf2\x2d\x1c\x0c\xbd\x3f\x41\x46\xb3" "\x9d\x44\x49\xfc\xb8\x73\x33\xd6\x55\xe6\x04\x9b\x8f\x6d\x6a" "\xe8\xc5\xdf\x54\x75\x75\x5e\x2a\xa2\xf7\xd7\x51\xca\x26\xce" "\x5f\x2d\xf6\x30\x03\x50\x06\x9b\x4b\xc8\x4f\xbc\x77\xa2\x8f" "\xda\xb3\x40\x39\xda\x6b\x26\xd7\x6b\x79\x06\x7f\x56\xb2\x88", 195); r[8] = syscall(__NR_writev, r[3], 0x201a2000ul, 0x1ul); r[9] = syscall(__NR_splice, r[2], 0x0ul, r[4], 0x0ul, 0x9ul, 0x4ul); } int main() { loop(); return 0; }